The question comes up the first time a firm takes on a client in Montreal or opens an office in Dublin. "We have people or clients in Quebec or Europe. Does our data have to be stored there?"
Usually, no. Both laws allow a US business to keep its data in the US, with conditions. The misunderstanding is that storage location is the compliance. It is not. The conditions are.
What the GDPR asks of a small US firm: a lawful way to move the data, which for most firms is the EU-US Data Privacy Framework or the standard contractual clauses written into a contract; security that fits the data; telling people and regulators about a breach within the deadline; and honoring the rights people have over their information, such as seeing it and having it deleted. One thing to know about the Data Privacy Framework: the EU's General Court upheld it in September 2025, that ruling was appealed to the Court of Justice, and the appeal is pending. The two frameworks before it were struck down, so a firm that relies on it keeps the contractual clauses as a backup.
What Quebec's Law 25 asks: a named person responsible for privacy, published on your website; an assessment before personal information leaves Quebec, showing it will be protected to an equivalent standard; reporting a breach to Quebec's regulator; and opt-in consent for tracking on your website. It applies to a business outside Quebec that handles Quebec residents' information, and the fines reach C$25 million or four percent of worldwide revenue for the serious cases.
When keeping data in the region does make sense: a client's contract requires it, your own assessment recommends it, or it is simply easier to defend. Then there are three plain options. Keep the data where it is with the safeguards above. Set up a separate Microsoft 365 for the foreign operation. Or, for a larger firm, use Microsoft 365 Multi-Geo, which keeps chosen people's mail, files and Teams data in another region inside one tenant.
What is yours and what is ours. The policies, the assessment and the legal choices belong to you and your counsel. The Microsoft 365 setup, the security controls behind it, and the evidence your privacy lead needs for an assessment are ours: that is Microsoft 365, set up to one standard, and the records and labels that come with Security + Compliance.
If you are opening that office or signing that client, it is a thirty-minute conversation before anything moves.
This note is not legal advice. The rules change, the court case above may change them again, and your counsel has the last word.
Questions people ask
Plain answers.
Does GDPR require our data to be stored in Europe?
No. It requires a lawful way to transfer it, security that fits the data, breach notification and respect for people's rights. Many US firms keep European clients' data in the US under the EU-US Data Privacy Framework or standard contractual clauses.
Does Quebec's Law 25 apply to a US company?
Yes, if it handles Quebec residents' personal information. It asks for a named privacy officer, an assessment before information leaves Quebec, breach reporting, and opt-in consent for website tracking.
What is Microsoft 365 Multi-Geo?
A Microsoft 365 option for larger firms that keeps chosen people's mail, OneDrive, SharePoint and Teams data in another region, such as Canada or Europe, inside one tenant. Smaller firms more often keep data in the US with safeguards or run a separate tenant for the foreign operation.
Let's talk
Thirty minutes with a real person.
Tell us what's going on with your technology, what's working and what isn't. We'll listen, ask a few questions, and tell you honestly whether we're the right fit. No slides, no pitch. If we can help, we'll say how. If we can't, we'll point you to someone who can.
Reach out, any way you like. A real person takes it from there.
Based in downtown Winter Haven since 1996, with offices in Orlando, Tampa, St. Petersburg, and Miami, serving businesses across Florida.